testing

2025-06-07 18:18:16 -04:00
parent 236ec455cc
commit d0aff716ff
14 changed files with 434 additions and 109 deletions
--- a/roles/webserver/files/docker-compose.yml
+++ b/roles/webserver/files/docker-compose.yml
@@ -1,5 +1,3 @@
-version: '3.5'
-
 volumes:
  wordpress:
  nextcloud:
@@ -10,7 +8,7 @@ networks:

 services:
  traefik:
-    image: traefik:${TRAEFIK_VERSION:-latest}
+    image: ${TRAEFIK_IMAGE:-docker.io/library/traefik}:${TRAEFIK_VERSION:-latest}
    restart: always
    command:
      - --api.dashboard=${TRAEFIK_DASHBOARD:-true}
@@ -20,7 +18,7 @@ services:
      - --providers.docker.exposedbydefault=${TRAEFIK_EXPOSED_DEFAULT:-false}
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
-      - --entrypoints.local.address=:8443
+      - --entrypoints.local.address=:9443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
@@ -33,11 +31,11 @@ services:
    environment:
      DREAMHOST_API_KEY: ${TRAEFIK_DREAMHOST_APIKEY}
    ports:
-      - 80:80
-      - 443:443
-      - "127.0.0.1:8443:8443"
+      - 8080:80
+      - 8443:443
+      - "127.0.0.1:9443:9443"
    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - ${OCI_SOCK:-/run/user/2000/podman/podman.sock}:/var/run/docker.sock:ro
      - ./.acme:/etc/letsencrypt
    labels:
      traefik.http.routers.api.rule: Host(`${TRAEFIK_DOMAIN:-traefik.local.freeitathens.org}`)
@@ -52,7 +50,7 @@ services:
      - traefik

  wordpress:
-    image: wordpress:${WORDPRESS_VERSION:-latest}
+    image: ${WORDPRESS_IMAGE:-docker.io/library/wordpress}:${WORDPRESS_VERSION:-latest}
    restart: always
    environment:
      WORDPRESS_DB_HOST: ${WORDPRESS_DB_HOST:-host.docker.internal}
@@ -81,7 +79,7 @@ services:
      - host.docker.internal:host-gateway

  nextcloud:
-    image: nextcloud:${NEXTCLOUD_VERSION:-stable}
+    image: ${NEXTCLOUD_IMAGE:-docker.io/library/nextcloud}:${NEXTCLOUD_VERSION:-stable}
    restart: always
    environment:
      MYSQL_HOST: ${NEXTCLOUD_MYSQL_HOST:-host.docker.internal:3306}
--- a/roles/webserver/handlers/main.yml
+++ b/roles/webserver/handlers/main.yml
@@ -4,12 +4,6 @@
    state: restarted
  listen: restart_mariadb

- name: Compose up on webserver stack
-  ansible.builtin.command: "docker-compose up -d"
-  args:
-    chdir: "{{ webserver_root }}"
-  listen: composeup_webserver
-
 - name: Grab Nextcloud container information
  community.docker.docker_container_info:
    name: "{{ webserver_root | basename }}_nextcloud_1"
@@ -22,11 +16,12 @@
    port: 80
  listen: composeup_webserver

- name: Check Nextcloud status
-  ansible.builtin.command: "docker exec --user www-data {{ webserver_root | basename }}_nextcloud_1
-            php occ status"
-  listen: composeup_webserver
-  register: nextcloud_status
+# - name: Check Nextcloud status
+#   ansible.builtin.command:
+#     "docker exec --user www-data {{ webserver_root | basename }}_nextcloud_1
+#     php occ status"
+#   listen: composeup_webserver
+#   register: nextcloud_status

 - name: Import Nextcloud installation handlers
  ansible.builtin.import_tasks: nextcloud.yml
@@ -34,3 +29,96 @@
  when:
    - nextcloud_status.stderr[:26] == "Nextcloud is not installed"
    - nextcloud_autoinstall
+
+- name: Import Webserver project handlers
+  ansible.builtin.import_tasks: webserver.yml
+
+- name: Install webserver docker-compose.yml
+  ansible.builtin.copy:
+    src: docker-compose.yml
+    dest: /home/oci/webserver/compose.yml
+    mode: "600"
+    owner: oci
+    group: oci
+  notify: Generate systemd service files
+
+#- name: Start podman compose project
+#  ansible.builtin.command:
+#    cmd: podman compose up -d
+#    chdir: /home/oci/webserver
+#  notify: Generate systemd service files
+#  become_user: oci
+#  become: true
+#  vars:
+#    ansible_become_user: oci
+#  environment:
+#    XDG_RUNTIME_DIR: "/run/user/2000"
+#    HOME: "/home/oci"
+
+- name: Start podman compose project
+  ansible.builtin.shell:
+    cmd: |
+      source /etc/profile
+      cd /home/oci/webserver
+      podman compose up -d
+  #notify: Generate systemd service files
+  notify: Debug handler environment
+  become: true
+  become_user: oci
+  become_flags: "-i"
+
+- name: Debug handler environment
+  ansible.builtin.shell: |
+    echo "=== HANDLER DEBUG ==="
+    whoami
+    id
+    env | grep -E "(USER|HOME|XDG|SUDO)" | sort
+    echo "=== PODMAN INFO ==="
+    podman info --format json | jq '.store.graphRoot, .store.runRoot'
+  become: true
+  become_user: oci
+  vars:
+    ansible_become_user: oci
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/2000"
+    HOME: "/home/oci"
+  listen: "Generate systemd service files"
+
+- name: Generate systemd service files
+  ansible.builtin.command:
+    cmd: podman generate systemd --new --files --file /home/oci/webserver/compose.yml
+    chdir: "/home/oci/.config/systemd/user"
+  notify: Reload systemd user daemon
+  become_user: oci
+  become: true
+  vars:
+    ansible_become_user: oci
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/2000"
+    HOME: "/home/oci"
+
+- name: Reload systemd user daemon
+  ansible.builtin.systemd:
+    daemon_reload: true
+    scope: user
+  notify: Enable systemd user service
+  become_user: oci
+  become: true
+  vars:
+    ansible_become_user: oci
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/2000"
+    HOME: "/home/oci"
+
+- name: Enable systemd user service
+  ansible.builtin.systemd:
+    name: webserver
+    enabled: true
+    scope: user
+  become_user: oci
+  become: true
+  vars:
+    ansible_become_user: oci
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/2000"
+    HOME: "/home/oci"
--- a/roles/webserver/handlers/webserver.yml
+++ b/roles/webserver/handlers/webserver.yml
@@ -0,0 +1,80 @@
+#- name: Start podman compose project
+#  ansible.builtin.command:
+#    cmd: podman compose up -d
+#    chdir: /home/oci/webserver
+#  notify: Generate systemd service files
+#  become_user: oci
+#  become: true
+#  vars:
+#    ansible_become_user: oci
+#  environment:
+#    XDG_RUNTIME_DIR: "/run/user/2000"
+#    HOME: "/home/oci"
+
+- name: Start podman compose project
+  ansible.builtin.shell:
+    cmd: |
+      source /etc/profile
+      cd /home/oci/webserver
+      podman compose up -d
+  #notify: Generate systemd service files
+  notify: Debug handler environment
+  become: true
+  become_user: oci
+  become_flags: '-i' 
+
+- name: Debug handler environment
+  ansible.builtin.shell: |
+    echo "=== HANDLER DEBUG ==="
+    whoami
+    id
+    env | grep -E "(USER|HOME|XDG|SUDO)" | sort
+    echo "=== PODMAN INFO ==="
+    podman info --format json | jq '.store.graphRoot, .store.runRoot'
+  become: true
+  become_user: oci
+  vars:
+    ansible_become_user: oci
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/2000"
+    HOME: "/home/oci"
+  listen: "Generate systemd service files"
+
+- name: Generate systemd service files
+  ansible.builtin.command:
+    cmd: podman generate systemd --new --files --file /home/oci/webserver/compose.yml
+    chdir: "/home/oci/.config/systemd/user"
+  notify: Reload systemd user daemon
+  become_user: oci
+  become: true
+  vars:
+    ansible_become_user: oci
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/2000"
+    HOME: "/home/oci"
+
+- name: Reload systemd user daemon
+  ansible.builtin.systemd:
+    daemon_reload: true
+    scope: user
+  notify: Enable systemd user service
+  become_user: oci
+  become: true
+  vars:
+    ansible_become_user: oci
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/2000"
+    HOME: "/home/oci"
+
+- name: Enable systemd user service
+  ansible.builtin.systemd:
+    name: webserver
+    enabled: true
+    scope: user
+  become_user: oci
+  become: true
+  vars:
+    ansible_become_user: oci
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/2000"
+    HOME: "/home/oci"
--- a/roles/webserver/tasks/main.yml
+++ b/roles/webserver/tasks/main.yml
@@ -1,72 +1,102 @@
 - name: Install MariaDB Server
-  ansible.builtin.apt:
+  ansible.builtin.dnf:
    name: mariadb-server
    state: present

 - name: Change the bind-address to allow Docker
  ansible.builtin.lineinfile:
-    path: /etc/mysql/mariadb.conf.d/50-server.cnf
+    path: /etc/my.cnf.d/mariadb-server.cnf
    regex: "^bind-address"
    line: "bind-address            = 0.0.0.0"
  notify: restart_mariadb

+- name: Start and enable MariaDB service
+  ansible.builtin.systemd:
+    name: mariadb
+    state: started
+    enabled: true
+
 - name: Install MySQL Support for Python 3
-  ansible.builtin.apt:
-    name: python3-pymysql
+  ansible.builtin.dnf:
+    name: python3-PyMySQL
    state: present

 - name: Create MariaDB databases
  community.mysql.mysql_db:
    name: "{{ item.name }}"
    state: present
-    login_unix_socket: /var/run/mysqld/mysqld.sock
+    login_unix_socket: /var/lib/mysql/mysql.sock
  loop: "{{ databases }}"
-  no_log: "{{ item.pass is defined }}"
+  no_log: true

 - name: Create MariaDB users
  community.mysql.mysql_user:
    name: "{{ item.name }}"
    password: "{{ item.pass }}"
-    host: '%'
+    host: "%"
    state: present
    priv: "{{ item.name }}.*:ALL"
-    login_unix_socket: /var/run/mysqld/mysqld.sock
+    login_unix_socket: /var/lib/mysql/mysql.sock
  loop: "{{ databases }}"
-  no_log: "{{ item.pass is defined }}"
+  no_log: true

- name: Create webserver docker-compose directory
+- name: Create webserver stack directory
  ansible.builtin.file:
-    path: "{{ webserver_root }}"
+    path: /home/oci/webserver
    state: directory
-    mode: 0600
+    mode: "700"
+    owner: oci
+    group: oci

- name: Install webserver docker-compose.yml
+- name: Install webserver compose file
  ansible.builtin.copy:
    src: docker-compose.yml
-    dest: "{{ webserver_root }}/docker-compose.yml"
-    mode: 0600
-  notify: composeup_webserver
+    dest: /home/oci/webserver/compose.yml
+    mode: "600"
+    owner: oci
+    group: oci
+  notify: Start podman compose project

- name: Install docker-compose .env
+- name: Generate webserver environment configuration
  ansible.builtin.template:
    src: compose-env.j2
-    dest: "{{ webserver_root }}/.env"
-    mode: 0600
-  notify: composeup_webserver
+    dest: /home/oci/webserver/.env
+    mode: "644"
+    owner: oci
+    group: oci
+  notify: Start podman compose project

- name: Allow MariaDB database connections
-  community.general.ufw:
-    rule: allow
-    port: 3306
-    proto: tcp
-    src: "{{ item }}"
-  loop: "{{ mariadb_trust }}"
+- name: Enable IP forwarding
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: "1"
+    state: present
+    reload: true

- name: Add HTTP and HTTPS firewall rule
-  community.general.ufw:
-    rule: allow
-    port: "{{ item }}"
-    proto: tcp
-  loop:
-    - "80"
-    - "443"
+- name: Allow port 80 in firewall
+  ansible.posix.firewalld:
+    port: 80/tcp
+    permanent: true
+    state: enabled
+    immediate: true
+
+- name: Forward port 80 to 8080
+  ansible.posix.firewalld:
+    rich_rule: 'rule family="ipv4" forward-port port="80" protocol="tcp" to-port="8080"'
+    permanent: true
+    state: enabled
+    immediate: true
+
+- name: Allow port 443 in firewall
+  ansible.posix.firewalld:
+    port: 443/tcp
+    permanent: true
+    state: enabled
+    immediate: true
+
+- name: Forward port 443 to 8443
+  ansible.posix.firewalld:
+    rich_rule: 'rule family="ipv4" forward-port port="443" protocol="tcp" to-port="8443"'
+    permanent: true
+    state: enabled
+    immediate: true